922 reputation
312
bio website boardspace.net
location
age
visits member for 3 years, 10 months
seen 10 hours ago

I develop games for fun.


May
22
comment Prevent shell script inside image file
If you're looking for uploaded images to be displayed by web browsers, there are only a few formats that are acceptable. You probably have other constraints too, such as file size and image size. I would write a perl script to open the image and validate or reject it, but depending on your environment and expertise level, there may be something more suitable available to you.
May
22
comment Prevent shell script inside image file
any image reader that can be tricked into running a shell script is buggy.
May
22
comment Prevent shell script inside image file
Those are by definition buggy image readers, and should not be used. There was one famously widespread instance of such a buggy reader, but it ought to be long extinct. There are always new exploits discovered, but trusting you image reader is not unreasonable.
May
7
comment Bring your own phone to a (new) job: Consequences?
Some employers require that you will allow them to wipe the phone if they feel the need. For me, that would be a deal killer.
Feb
22
comment How is it possible to embed executable code in an image
It was years ago and I don't have the details at hand. There was a rush to replace one particular windows dll.
Aug
20
comment Is a biometric eye scan more secure than a multi-factor authentication
I don't know about you, but bad guys who point a gun at me and demand my smart card and my pin, get it.
Feb
10
comment How can this input-sanitizer function be defeated?
It seems to me that any aproach to sanitizing SQL commands that is based on searching for particular strings, without fully parsing the commands, cannot possibly work. At the very least, every time one of the blacklisted terms occurs innocently in a text field you will get a false positive.
Jan
9
comment Someone faxed me a bunch of black paper
Two possibilities (1) just deserts - your company pollutes my phone, I pollute your faxes. (2) your attacker is a telemarketer hoping to sell toner cartridge refills.
Jan
9
comment Someone faxed me a bunch of black paper
Given ubiquitous caller id spoofing, the number printed across the top, if any, is legally meaningless. Ask the NSA who called you.
Oct
21
comment Why are security-crucial software written in unsafe languages?
@everyone I agree completely that C/C++ is less safe than almost any alternative, but the question was cast as safe verses unsafe. Nothing is safe.
Oct
19
comment Why are security-crucial software written in unsafe languages?
There are no safe languages. C/C++ may be less safe, but it's only a relative difference, not a qualitative one. Software vulnerabilities come from bad design and flawed implementation of good designs, and no language removes that.
Oct
2
comment How does the Mega-D BotNet send spam?
I do not mean a relay server - they are essentially extinct as you say. I mean renting a server and using it to pump out spam directly.
Aug
31
comment Scan Source Code for Potential Viruses
right on the money. malicious source code is unlikely to have a module called "malware".
Aug
30
comment Would IT Security professionel people notice a backdoor in Windows 7 or SBS 2011 implemented by Microsoft?
Another thought; microsoft (and many other vendors) do not even need a back door. We've been trained to give them the keys to the front door. Anytime one of the vendors who routinely load updates on my machines wants to do something either for me or to me, I am powerless to resist - unless I'm willing to risk that certified malware won't get me if I do.
Aug
30
comment Would IT Security professionel people notice a backdoor in Windows 7 or SBS 2011 implemented by Microsoft?
So windows machines are perfectly secure then; I guess I was wrong about everything, and all those security patches are just for show. Meanwhile, back in reality, windows OS security is swiss cheese. Microsoft has never been held liable for uncounted losses due to security breaches. No one knows what all those patches do or what doors have been deliberately or only inadvertantly left open.
Aug
20
comment Can malware come in any format?
no known way. One famous example was an exploit of widely used jpeg reading code.
Aug
18
comment Cheating or service disruption by altering client-side code
I'm not in the "nothing is better than something" camp. Short of completely abandoning smart clients, something is better than nothing.
Aug
18
comment Cheating or service disruption by altering client-side code
then how would you recommend detecting that a client is attempting to tamper? I'm soliciting better ideas.
Aug
15
comment email on hosting company's site hacked?
I think changing browsers is a plausible suggestion for any problem involving use of a browser. IE used to be a seething pit of security flaws, and all browsers have their share of unexplained behaviors. If your browser is compromised, misconfigured, or just plain broken, changing it will frequently "fix" the problem.
Aug
14
comment Cheating or service disruption by altering client-side code
Thanks, you've added a lengthy exposition of what I took as a given, and omitted in the interests of keeping the posting brief. The ideas in the "mitigation" link you provided are the kind of thing I was looking for.